# I-SAML, ngaphansi kwe-hood: isiginesha engaphakathi kwencwadi

Published: 2026-09-24

I-SAML ikungena cishe kuzo zonke izinhlelo zokusebenza zomsebenzi, futhi isiginesha sayo siphila ngaphakathi kwe-XML esiyisayina. Ngaphansi kwe-hood: ukungena okujwayelekile phakathi kohlelo lokusebenza, isiphequluli nomhlinzeki wobunikazi, ukuthi isitatimende sibukeka kanjani, kungani ukuqondanisa kufanele kuvumelane kuwo wonke ama-byte, nokuthi kungani uhlobo olufanayo lweziphazamiso luqhubeka lubuya kusukela ngo-2012 kuya ku-2025. Kukukhuthazwe yi-"SAML: A fractal of bad design" (amaphuzu angu-312 ku-Hacker News) ye-Trail of Bits.

Canonical: https://thedailydiff.dev/zu/video/2026-09-24-saml-under-the-hood/

## Lokho okuhlanganiswa yile vidiyo

- I-SAML: ukungena okuzisayinayo kusuka ngaphakathi
- 2002: amafomethi amane e-XML, ikomidi elilodwa, imboni yonke
- Ukungena okujwayelekile: uhlelo lokusebenza → umhlinzeki wobunikazi → ubuyela ngesiphequluli sakho
- Isitatimende: isiginesha iphila ngaphakathi kwalokho ekusayinayo
- Ukuqondanisa: vumelana ngayo yonke i-byte, noma akekho ongenayo

## Izahluko

- 0:00 I-SAML: ukungena okuzisayinayo kusuka ngaphakathi
- 0:34 2002: amafomethi amane e-XML, ikomidi elilodwa, imboni yonke
- 0:46 Ukungena okujwayelekile: uhlelo lokusebenza → umhlinzeki wobunikazi → ubuyela ngesiphequluli sakho
- 0:59 Isitatimende: isiginesha iphila ngaphakathi kwalokho ekusayinayo
- 1:10 Ukuqondanisa: vumelana ngayo yonke i-byte, noma akekho ongenayo
- 1:32 2012: umhloli nomfundi babheka izinto ezihlukene
- 1:51 2018 no-2025: ama-parser amabili, izimpendulo ezimbili ezihlukene
- 2:08 Kungani iqhubeka iphuka: i-fractal yokuklama okubi
- 2:27 NgoMsombuluko: i-OIDC kuqala, umtapo wolwazi ogcinwe, izimo eziqinile
- 2:43 Isinqumo, ngaphansi kwe-hood: REVERT

## Umbhalo obhaliwe ohunyushwe

Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube.

### I-SAML: ukungena okuzisayinayo kusuka ngaphakathi

0:00 I-SAML iyi-XML ekungena cishe kuzo zonke izinhlelo zokusebenza zomsebenzi onazo, futhi isiginesha sayo siphila ngaphakathi kwedokhumenti esiyisayinayo, njengonotari ebeka isitembu sakhe ngaphakathi kwemvilophi ayivalayo. Eminyakeni eyishumi ngemuva kokuba ikomidi libhale, abacwaningi bahlola ama-framework ayishumi nane e-SAML Ayishumi nanye awile. Futhi kuleli sonto okuthunyelwe kwe-Trail of Bits okukubiza nge-fractal yokuklama okubi kushaye ikhasi eliyinhloko le-Hacker News. Ngemizuzu emithathu: ukuthi ukungena okujwayelekile kusebenza kanjani, lapho isiginesha ifihla khona,

0:27 nokuthi kungani ukulungisa wonke umuntu avumelana ngakho kuyiphrothokholi ehlukile. Lena yi-The Daily Diff, ngaphansi kwe-hood.

### 2002: amafomethi amane e-XML, ikomidi elilodwa, imboni yonke

0:34 Unyaka ka-2002. Ikomidi lezokuphepha e-Oasis lihlanganisa amafomethi amane e-XML omthengisi abe munye. Amanyuvesi ayakwamukela kuqala, bese i-Okta yakha inkampani ngakho, okushesha kakhulu idokhumenti yekhomidi elaba yinzuzo. Uvula uhlelo lokusebenza.

### Ukungena okujwayelekile: uhlelo lokusebenza → umhlinzeki wobunikazi → ubuyela ngesiphequluli sakho

0:46 Alwazi ukuthi ungubani, ngakho luhambisa isiphequluli sakho kumhlinzeki wobunikazi, ngisho i-Okta yenkampani yakho. Ugena lapho. I-Okta inika isiphequluli sakho idokhumenti ye-XML esayiniwe esho ukuthi ungubani, futhi isiphequluli siyibuyisela emuva.

### Isitatimende: isiginesha iphila ngaphakathi kwalokho ekusayinayo

0:59 Lelo dokhumenti yisitatimende. Iqamba umsebenzisi, futhi isiginesha ihlala ngaphakathi kuyo, ikhomba emuva esitatimendeni nge-ID yaso. Futhi yonke into ihamba ngesiphequluli sakho, okungukuthi, ngomsebenzisi. Ukuyihlola, uhlelo lokusebenza

### Ukuqondanisa: vumelana ngayo yonke i-byte, noma akekho ongenayo

1:11 lakha kabusha ama-byte aqondile asayiniwe. Lisika isiginesha, lenza isikhala sibe yinto eyodwa kanye ne-attribute oda, bese li-hash umphumela. Lokho ukuqondanisa, futhi uma izinhlangothi ezimbili zingavumelani nge-byte eyodwa, akukho ongenayo. I-JSON web token ikwenza ngokuhlukile. I-Header, i-payload nesiginesha kuhlala eduze ngamachashazi phakathi. Akukho okunqamulayo kuqala.

### 2012: umhloli nomfundi babheka izinto ezihlukene

1:32 Nasi isiphazamiso. Ikhodi ehlola isiginesha nekhodi efunda igama lomsebenzisi ngokuvamile ziyizicucu ezimbili ezihlukene. Ngo-2012, iphepha elibizwa ngokuthi i-On Breaking Saml labonisa ukuthi ungahambisa isitatimende esisayiniwe lapho umfundi angasinaki khona, bese ubeka esesibili lapho ebheka. I-Salesforce ne-Shibboleth zazingezinye zeshumi nanye ezawela kulokho. Ngo-2018, i-Duo yabona ukuthi ukuphawula ngaphakathi kwegama lomsebenzisi kungenza okunye

### 2018 no-2025: ama-parser amabili, izimpendulo ezimbili ezihlukene

1:55 imithapo yolwazi ifunde igama eliyingxenye kuphela, kanti isiginesha isahloliwe. Ngo-2025, i-GitHub yathola ama-parser amabili e-XML ngaphakathi kwe-ruby Saml engavumelani ngedokhumenti efanayo. Isiphazamiso esifanayo, ideshi entsha. I-Trail of Bits ikubiza nge-fractal, ngoba wonke amazinga ongena kuwo anesiphazamiso

### Kungani iqhubeka iphuka: i-fractal yokuklama okubi

2:12 esifanayo. Yakhelwe nge-XML, isiginesha ifakwe ngaphakathi, futhi ukungena kwangempela kusebenzisa cishe ingxenye yeshumi kuphela ye-spec. Futhi impendulo ephezulu ku-Hacker News ivela kumthengi. Uma ungenayo i-SAML support, ngingathola umkhiqizo onawo. Kokubili kuyiqiniso, okuyinkinga. Ngakho, ngoMsombuluko. SHIP IT i-OpenID Connect kuqala, i-Fly ne-Tailscale zithengisela

### NgoMsombuluko: i-OIDC kuqala, umtapo wolwazi ogcinwe, izimo eziqinile

2:31 izinkampani ngaphandle kwe-SAML nhlobo. Uma ikhasimende liphoqa, sebenzisa umtapo wolwazi ogcinwe, uwugcine ufakiwe, futhi wenqabe imilayezo engabukeki njengaleyo i-Okta noma i-Google eyithumelayo. Ungalokothi ubhale isheke lakho lesiginesha.

### Isinqumo, ngaphansi kwe-hood: REVERT

2:43 Isinqumo, ngaphansi kwe-hood. REVERT. Cishe iminyaka engu-25, uhlobo olulodwa lwesiphazamiso olungafi, futhi ukulungisa wonke umuntu avumelana ngakho kuyiphrothokholi ehlukile. NgoMgqibelo odlule ngahlukanisa ama-passkeys, ngakho ngitshele ukuthi yini okufanele ngiyivule ngokulandelayo kuma comments. Futhi lena yi-diff yanamuhla. NginguNiko ovela e-Axrisi. Hlanganisa ngokuzibopha.

## Imithombo

- [Trail of Bits, "SAML: A fractal of bad design" (Matt Schwager, Sep 21, 2026)](https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/) — blog.trailofbits.com
- [Hacker News thread](https://news.ycombinator.com/item?id=49806335) — news.ycombinator.com
- [Somorovsky et al., "On Breaking SAML: Be Whoever You Want to Be", USENIX Security 2012](https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/somorovsky) — www.usenix.org
- [Duo Labs, SAML vulnerabilities affecting multiple implementations (2018): https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations · CERT VU#475445](https://www.kb.cert.org/vuls/id/475445) — www.kb.cert.org
- [GitHub Security Lab, "Sign in as anyone: Bypassing SAML SSO authentication with parser differentials" (Mar 12, 2025)](https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/) — github.blog